‫Correct timing and then map scans is important for the accuracy and effectiveness of the scan.
‫In the case of outside scans, it is usually preferable to use flow scans to avoid devices such as IPS
‫and ideas, whereas in a scan from an internal network, quick scan options will be preferred.
‫While a fine grained timing controls are powerful and effective, fortunately, and MAP offers a simple
‫approach with six timing templates.
‫You can specify them with the uppercase T option and their number zero through five or their name,
‫the template names are paranoid zero, sneaky one polite to normal three, aggressive four and insane
‫five.
‫The first two are for yds.
‫Evasion, polite mode slows down the scan to use less bandwidth and target machine resources.
‫Normal mode is the default, and so T3 does nothing aggressive mode speed scan's up by making the assumption
‫that you were on a reasonably fast and reliable network.
‫Finally, insane mode assumes that you're on an extraordinarily fast network or you're willing to sacrifice
‫some accuracy for speed.
‫Max Retries option is to specify the maximum number of ports can probe retransmissions.
‫When and receives no response to a port Schenn probe, it could mean that the port is filt, or maybe
‫the prober response was simply lost on the network.
‫It's also possible that the target host has rate limiting, enable that temporarily block the response.
‫So and Matt tries again by retransmitting the initial probe.
‫If Unmap detects poor network reliability, it may try many more times before giving up on a port.
‫And while this benefits accuracy, it also lengthens scanned times.
‫So when performance is critical, scan's may be sped up by limiting the number of retransmissions allowed.
‫You can even specify Max Retries zero to prevent any retransmissions, though that's only recommended
‫for situations such as informal surveys where occasional misreports and hosts are acceptable.
‫The default with no uppercase t template is to allow 10 retransmissions.
‫Host timeout is used to give up slow target, some hosts simply take a long time to scan.
‫This may be due to poorly performing or unreliable networking hardware or software package rate limiting
‫or restricted firewall.
‫The slowest few percent of the scanned hosts can eat up a majority of the scanned time.
‫Sometimes it's best to cut your losses and skip to those hosts initially.
‫Specify host time out with a maximum amount of time, you're willing to wait, for example, specify
‫30 minutes to ensure that and MAP doesn't waste more than half an hour on a single host.
‫Note that any map may be scanning other hosts at the same time during that half an hour, so it's not
‫a complete loss.
‫And MAP utilizes parallelism and many advanced algorithms to accelerate the scans, especially in the
‫case of external scans, it may be necessary to close the parallel scan, that is, to send a single
‫packet to a server at the same time.
‫And MAP utilizes different options for this purpose, as we saw just a few minutes ago.
‫You can manage the timing using uppercase t option if you use the templates zero paranoid, one sneaky
‫or too polite parallelization is closed.
‫That means these templates serialize is the scan, so only one board is scanned at a time scan, delay
‫option courses and map to wait at least the given amount of time between each probe it sends to a given
‫host.
‫This is particularly useful in the case of rape limiting.
‫Solaris machines, among many others, will usually respond to UDP scan probe packets with only one
‫ICMP message per second, any more than that sent by unmap will be wasteful.
‫Scan delay of one second will keep and map at that slow rate.
‫And Matt tries to detect rate limiting and a the scandal delay according, but it doesn't hurt to specify
‫it explicitly if you already know what rate works best.
‫OK, so by default and map calculate an ever changing ideal parallelism based on network performance.
‫The Max Parallelism option is sometimes set to one to prevent and map from sending more than one probe
‫at a time to hosts.
‫And MAP has the ability to scan or a version scan multiple hosts in parallel and map does this by dividing
‫the target IP space into groups and then scanning one group at a time.
‫What a maximum group size is specified with Max, host, group and map will never exceed that size.
‫So if you specify maximum number of hosts in a group as one using max hosts group option.
‫There will be only one host in the group and only one host will be scanned at a time.
‫So what do you reckon the difference is between the Max parallelism and the Max host group?
‫Did you see it?
‫When you set Max parallelism to one end map sends only one packet to a host at a time.
‫When you said Max host group to one and map scans only one host at a time.